Team and roles

Team Management is where you control who can use your workspace and what they can do. Everyone in a workspace works on the same books: a report one member creates is there for everyone, and a statement one member maps is mapped for everyone. Roles are the only thing that differs from person to person. A role is a named set of permissions, and each permission allows one thing, such as uploading bank files or viewing invoices.

Open it from Team Management under Account in the sidebar.

Before you start

You need permission to view the team to open this page. Inviting, changing roles and removing members each need their own permissions. Super admins and admins have all of them.
Team invitations are free on every plan.

The tabs

Tab	What it’s for
Members	Everyone in the workspace, their role, status and last sign-in.
Invitations	Invitations you’ve sent and whether they’ve been accepted.
External access	Accounting firms that work on your books. Appears when your workspace can work with an accountant.
Custom Roles	The system roles and any roles you create, with their permissions.
AI Gateway	Per-role limits on AI usage, agents and workflows.
API Keys	Keys for connecting other software. Appears only for roles that can manage API keys.
Audit Log	A record of every change made in the workspace. Appears for roles that can view the audit log.

Invite a member

Go to Team Management and select Invite member.
Enter the person’s Email and choose their Role.
Select Send invitation.

Bokapsys emails them a link to join. If they already have a Bokapsys account, they sign in to accept; if not, they create one. After you send the invitation, the dialog also shows the accept link, which you can pass on yourself if the email is slow to arrive.

On the Invitations tab you can see each invitation’s status and when it expires. Select Resend to send a fresh link, or Revoke to cancel an invitation that hasn’t been accepted.

Change a member’s role

On the Members tab, pick a new role from the member’s Role dropdown. The change is saved immediately.

Members who joined through an accounting firm show a via badge with the firm’s name. You can’t change their role here, because their access belongs to the firm’s engagement. Manage it under External access instead. See Firm access.

Deactivate or remove a member

Deactivate stops a member signing in to this workspace but keeps them on the list. Select Reactivate to restore their access.
Remove takes them out of the workspace. They lose access immediately.

Either way, nothing they did is undone. Their statements, entries and other work stay in the workspace, and the audit log keeps the record of who did what.

System roles

Every workspace starts with eight system roles. Here is what each one starts with. A super admin can adjust the permissions of any system role, so your workspace’s roles may differ. The Custom Roles tab always shows exactly what each role allows.

Role	Starts with
super_admin	Everything in the workspace: all bookkeeping and accounting, invoicing, team and roles, company settings, billing, the audit log and deleting the workspace. The person who creates a workspace is its super admin.
admin	Everything a super admin can do, except viewing the audit log and deleting the workspace.
manager	Uploading and managing statements, bank feeds, the full accounting area (journal entries, General Ledger, Chart of Accounts, reconciliation, accruals, schedules, budgets and reports), Smart Chat, the Inbox, viewing the team and inviting members, approving items, running workflows and viewing the audit log.
cfo	Reports, journal entries, the General Ledger, year-end close, budgets and schedules, bank feeds, Smart Chat, managing AI agents and workflows, approval policies, the Inbox, billing and the audit log.
bookkeeper	Uploading and viewing statements, journal entries, the General Ledger, Chart of Accounts, reconciliation, accruals, schedules, reports, trial balance and QuickBooks imports, and the Inbox.
auditor	Read-only access to statements, the General Ledger, reports and the audit log.
user	Viewing statements and the dashboard. When Payroll is in use and they’re on the payroll, they can also see their own payslips, tax forms, W-4 and direct deposit.
employee	Only their own pay records: payslips, tax forms, W-4 and direct deposit, plus their profile and notifications. They see nothing of the company’s books.

You can’t rename or delete a system role.

Give employees self-service access

Use the employee role for people who are on your payroll but don’t work in your books. They can check their payslips, download their tax forms, update their W-4 and change the bank account their pay goes to, and nothing else.

Make sure the person is set up as an employee in Payroll, under People, with the same email address you’re about to invite.
In Team Management, select Invite member.
Enter their Email, choose the employee role, and select Send invitation.

When they sign in, they land on My Account, which links to My Payslips, My Tax Forms, My W-4 and My Direct Deposit. Those pages are also under Account in their sidebar. See Employee self-service.

Create a custom role

On the Custom Roles tab, select New role.
Enter a Name and an optional Description.
Under Permissions, tick what the role should allow. Permissions are grouped by area. Use the search box to find one, Select all to tick a whole group, and Expand all to open every group.
Select Save.

Select Edit on any role to change it, or Delete to remove a custom role. If you delete a role that people hold, give them a new role.

When you change a role’s permissions, everyone who holds it is asked to sign in again, so the new permissions apply straight away.

Limit AI usage by role

The AI Gateway tab shows your plan and, for each role, three limits that apply to every member who holds it:

Monthly tokens: how much AI each member can use per billing period. Smart Chat questions, statement classification and other AI features count towards it.
Max AI agents: how many AI agents each member can create.
Max workflows: how many workflows each member can create.

A limit of 0 means unlimited. Select Edit on a role to change its limits, then select Save limits.

The tiles at the top show your own usage against your role’s limits, including how many days are left in the period.

These limits sit inside your workspace’s overall AI allowance, which is set by your plan. See Subscriptions.

External access

If an accountant or bookkeeper works on your books from their own Bokapsys firm account, they appear on the External access tab. For each firm you can see their access level, how many of their people have access and since when, and select Show people to list them. Remove access cuts off everyone from that firm at once. Nothing they created is deleted, and the audit log keeps the full record.

The same tab lets you manage the access levels you allow firms to hold. See Firm access for the full guide.

API keys

The API Keys tab is shown only to members whose role includes managing API keys. No system role includes it by default. If you need API access to connect other software, contact us.

Audit log

The Audit Log tab lists changes made in the workspace, newest first: when it happened, who did it (with their role) and what they did, such as posting an invoice, changing a role or correcting a classification.

Use the search box to find entries by action, person or record.
Use Previous and Next to page through the history.

Entries can’t be edited. A super admin can delete selected entries or select Clear all, and clearing the log is itself recorded as a new entry.

Profile and sign-inTwo-factor authentication and your own account.

Firm accessControl what your accounting firm can do.

Security overviewHow access to your data is controlled.